Privacy Policy

PRIVACY POLICY

Effective Date: [DD/MM/YYYY] Last Updated: [DD/MM/YYYY] Website: Meridukan.app Legal Entity / Company Name: [Legal Company Name] Registered Address: [Full Registered Address] Email: [Privacy/Support Email] Phone: [Customer Support Number]

________________________________________

1. INTRODUCTION

Welcome to Meridukan.app (“Meridukan”, “we”, “us”, “our” or “Platform”). Meridukan.app is a multi-category and multi-vendor online marketplace through which customers can discover, purchase and receive products and services offered by participating vendors/sellers.

The Platform may provide services including:

• Customer registration and account management • Vendor/seller registration and marketplace services • Product browsing and ordering • Online payment through payment gateways • UPI payments • Cash on Delivery (COD) • Order processing and tracking • Delivery services • OTP-based order/delivery verification • Customer support • Vendor management • Referral and earning/reward programmes • Promotional offers and communications • Other marketplace-related services This Privacy Policy explains how Meridukan.app collects, uses, stores, shares and protects personal information when you use our website, application, marketplace or related services. By accessing or using Meridukan.app, you acknowledge that you have read and understood this Privacy Policy.

________________________________________

2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to information collected through: 1. Meridukan.app website; 2. Meridukan mobile application, where applicable; 3. Customer accounts; 4. Vendor/seller accounts; 5. Delivery-related services; 6. Referral and earning programmes; 7. Payment and transaction processes; 8. Customer support interactions; 9. Promotional and marketing communications; and 10. Other services operated by or on behalf of Meridukan. This Policy applies to customers, vendors/sellers, delivery personnel and other users of the Platform to the extent their personal data is processed by Meridukan.

________________________________________

3. PERSONAL DATA WE MAY COLLECT

Depending on how you use Meridukan.app, we may collect the following categories of personal data. 3.1 Customer Information

This may include:

• Full name • Mobile number • Email address • Login credentials or authentication information • Delivery address • Billing address • Pincode • City, State and Country • Order details • Customer preferences • Communication history • Customer support information 3.2 Vendor Information For vendor/seller registration and verification, we may collect information such as: • Vendor name • Owner/authorised person’s name • Mobile number • Email address • Business address • Pickup/warehouse address • Bank/payment settlement information • Business-related documents • Tax/GST information, where applicable • PAN or other identification information where legally required • Product and inventory information • Transaction and settlement records The exact information requested may depend on the vendor’s business type and applicable legal or regulatory requirements. 3.3 Delivery Information

For order fulfilment and delivery, we may process:

• Customer name • Mobile number • Delivery address • Order number • Delivery instructions • Delivery status • OTP or delivery verification information • Information required to confirm successful delivery

________________________________________

4. OTP-BASED DELIVERY VERIFICATION

Meridukan may use an OTP-based delivery verification system. When an order is delivered, an OTP may be sent to the registered mobile number of the customer.

The OTP may be used to:

• Verify the customer/order recipient; • Confirm delivery; • Reduce fraudulent delivery claims; • Prevent unauthorised delivery completion; • Maintain delivery records. Customers should not share delivery OTPs with unknown persons. Meridukan may retain records relating to OTP verification and delivery confirmation for legitimate business, dispute-resolution, fraud-prevention, accounting, security and legal purposes.

________________________________________

5. PAYMENT INFORMATION

Meridukan may offer different payment methods, including:

• UPI;

• Cash on Delivery (COD); • Debit/Credit Card, where supported; • Net Banking, where supported; • Other payment methods made available through our payment partners. Payment Gateway Online payments may be processed through third-party payment gateways/payment service providers. Where applicable, payment information may be transmitted directly to the relevant payment service provider. Meridukan generally does not require or intend to store complete card credentials such as full card numbers, CVV or other authentication credentials unless specifically permitted and required under applicable law and the relevant payment arrangement. Payment providers may process information according to their own privacy policies, terms and applicable laws. For payment-related disputes, refunds or transaction verification, Meridukan may process transaction IDs, payment status, order information and other necessary transaction-related information.

________________________________________

6. CASH ON DELIVERY (COD)

Where COD is available, Meridukan may collect and process information necessary to: • Confirm the order; • Verify the delivery address; • Coordinate delivery; • Record the amount collected; • Confirm successful delivery; • Detect fraudulent or suspicious orders; • Manage returns, cancellations and refunds. Repeated failed COD orders, suspicious ordering activity or misuse of COD may result in restrictions on COD availability, subject to applicable terms and law.

________________________________________

7. REFERRAL AND EARNING PROGRAMME

Meridukan may provide a referral, rewards, commission or earning programme under which eligible customers or users may earn rewards/benefits subject to applicable programme conditions. For operating the referral programme, Meridukan may process information such as: • Referral ID/code; • Referrer’s account information; • Referred user’s account information; • Referral activity; • Eligible orders/transactions; • Order status; • Cancellation/return/refund status; • Reward/earning calculations; • Payment or settlement information, where applicable. Earning Conditions Referral earnings are not automatically guaranteed merely because a referral link/code is used.

Eligibility and earning may depend on conditions such as:

• Successful registration; • Eligible order completion; • Minimum order value; • Payment completion; • Non-cancellation; • Non-return/refund status; • Programme-specific conditions; • Fraud or abuse checks; • Other conditions communicated by Meridukan. Meridukan may cancel, hold, adjust or reverse referral rewards where an activity is found to be invalid, fraudulent, duplicated, abusive, cancelled, refunded or otherwise outside the applicable programme conditions, subject to applicable law. Any applicable earning/reward terms should be displayed separately in the Referral/Earning Programme Terms.

________________________________________

8. WHY WE COLLECT AND USE PERSONAL DATA

Meridukan may process personal data for legitimate and disclosed purposes, including: A. Account Management

To:

• Create and maintain accounts; • Authenticate users; • Verify mobile numbers/email addresses; • Manage customer and vendor profiles. B. Order Processing

To:

• Accept and process orders; • Confirm orders; • Communicate order status; • Coordinate vendors and delivery; • Process cancellations, returns and refunds. C. Delivery

To:

• Provide products to the customer’s address; • Contact customers regarding delivery; • Verify delivery using OTP; • Track delivery status; • Prevent delivery fraud. D. Payments

To:

• Process payments; • Confirm payment status; • Process refunds; • Reconcile transactions; • Prevent payment fraud. E. Vendor Operations

To:

• Onboard vendors; • Verify vendor information; • Manage product listings; • Process vendor settlements; • Maintain transaction records; • Communicate marketplace-related information. F. Referral/Earning System

To:

• Track referrals; • Calculate eligible rewards; • Detect misuse; • Process eligible payouts/rewards. G. Customer Support

To:

• Respond to complaints; • Resolve order issues; • Handle refunds/returns; • Investigate disputes; • Improve customer service. H. Security and Fraud Prevention

To:

• Detect suspicious activity; • Prevent account abuse; • Prevent fraudulent transactions; • Protect users and the Platform; • Maintain system security. I. Legal and Regulatory Compliance

To comply with applicable:

• Laws; • Regulations; • Court orders; • Government directions; • Tax/accounting requirements; • Consumer protection requirements; • Data protection requirements.

________________________________________

9. CONSENT

Where consent is required as the legal basis for processing personal data, Meridukan will seek consent in an appropriate manner.

Consent may be obtained through methods such as:

• Website/app controls; • Checkboxes; • OTP verification; • Electronic communication; • Other legally recognised mechanisms. Consent should be specific, informed and provided through clear affirmative action where required by applicable law. Under the DPDP framework, consent-based processing may be withdrawn by the Data Principal, subject to applicable legal requirements and consequences. Withdrawal of consent does not necessarily require Meridukan to delete or stop processing information where continued processing is required or authorised by applicable law, or is necessary for certain legitimate purposes such as completing an existing transaction where legally permitted.

________________________________________

10. INFORMATION SHARING

Meridukan may share necessary information with selected third parties where required to provide the Platform’s services.

These may include:

Vendors/Sellers Information necessary for fulfilling an order may be shared with the relevant vendor.

For example, this may include:

• Customer name; • Delivery information; • Contact information; • Order details. Delivery Partners Information necessary to deliver an order may be shared with delivery personnel or logistics partners. Payment Service Providers Necessary payment and transaction information may be shared with payment gateways/payment service providers. Technology and Service Providers

We may use third-party providers for:

• Hosting; • Cloud infrastructure; • SMS/OTP services; • Email; • Notifications; • Analytics; • Security; • Customer support; • Payment processing; • Logistics; • Software infrastructure. Government and Legal Authorities Information may be disclosed where required or permitted by applicable law, legal process, court order or government direction.

________________________________________

11. THIRD-PARTY SERVICE PROVIDERS

Meridukan may use third-party service providers to operate specific functions of the Platform.

Examples include:

• Payment gateways; • UPI/payment service providers; • SMS/OTP providers; • Cloud hosting providers; • Delivery/logistics providers; • Analytics providers; • Communication providers; • Security providers. Such third parties may process personal data only to the extent necessary for the services they provide and subject to applicable contractual, security and legal requirements. Users should also review the privacy policies of relevant third-party service providers where applicable.

________________________________________

12. COOKIES AND TRACKING TECHNOLOGIES

Meridukan may use cookies, local storage, pixels and similar technologies.

These technologies may be used for:

• Login/session management; • Website functionality; • Security; • Preferences; • Analytics; • Performance improvement; • Personalisation; • Marketing, where applicable. Users may control certain cookies through their browser or device settings. Disabling certain cookies may affect some Platform features.

________________________________________

13. DEVICE AND TECHNICAL INFORMATION

When you use Meridukan.app, certain technical information may automatically be collected, such as: • IP address; • Browser type; • Device type; • Operating system; • Application version; • Login/session information; • Date and time of access; • Pages/features accessed; • Error and diagnostic information; • Security-related information. This information may be used for security, troubleshooting, analytics, performance and service improvement.

________________________________________

14. DATA SECURITY

Meridukan takes reasonable security measures designed to protect personal data against: • Unauthorised access; • Unauthorised disclosure; • Loss; • Misuse; • Alteration; • Destruction; • Other reasonably foreseeable security risks.

Security measures may include, where appropriate:

• Access controls; • Authentication mechanisms; • Encryption/security technologies; • Secure communication; • Monitoring; • Backups; • Internal access restrictions; • Vendor/service-provider controls. However, no internet transmission or electronic storage system can be guaranteed to be completely secure. Users should keep their passwords, OTPs and account credentials confidential.

________________________________________

15. DATA RETENTION

Meridukan will retain personal data only for as long as reasonably necessary for the purposes for which it was collected, or for other purposes permitted or required by applicable law.

Retention periods may depend on:

• Account status; • Order history; • Payment/transaction records; • Tax/accounting requirements; • Legal requirements; • Dispute resolution; • Fraud prevention; • Security requirements; • Referral/earning records; • Business and regulatory requirements. When personal data is no longer required and there is no legal or legitimate reason to retain it, Meridukan may delete, anonymise or otherwise dispose of it in accordance with applicable requirements.

________________________________________

16. USER RIGHTS

Subject to applicable law and applicable procedures, users may have rights relating to their personal data, including rights to: • Obtain information about processing of their personal data; • Request access to relevant personal data; • Request correction/update of inaccurate information; • Request deletion/erasure where applicable; • Withdraw consent where consent is the basis of processing; • Raise a grievance regarding personal-data processing; • Nominate another individual to exercise rights in accordance with applicable law, where available. The DPDP Act provides Data Principals with rights concerning access to information, correction/erasure, grievance redressal and nomination, subject to the Act and applicable rules. Requests may be submitted through the contact details provided in this Privacy Policy.

________________________________________

17. DATA CORRECTION

If you believe that information associated with your account is inaccurate or incomplete, you may request correction through: Email: [Privacy/Support Email] You may be required to provide reasonable information necessary to verify your identity before a request is processed.

________________________________________

18. DATA DELETION / ACCOUNT DELETION

Users may request deletion of their account or personal data where applicable. Upon receiving a valid request, Meridukan may delete or anonymise personal data that is no longer required. However, certain information may need to be retained where necessary for: • Legal compliance; • Tax/accounting records; • Fraud prevention; • Security; • Dispute resolution; • Transaction records; • Enforcement of contractual rights; • Other legally permitted purposes.

________________________________________

19. MARKETING AND PROMOTIONAL COMMUNICATIONS

Subject to applicable law and user preferences, Meridukan may send: • Offers; • Discounts; • Product recommendations; • Referral programme information; • Promotional messages; • Service updates; • Notifications. Users may opt out of certain promotional communications using available unsubscribe/communication preference mechanisms. Transactional and essential service communications may continue where necessary to provide the requested service.

________________________________________

20. CHILDREN’S DATA

Meridukan’s services are intended to be used by persons who are legally permitted to use online marketplace services. Where applicable law requires parental consent or imposes additional requirements for processing a child’s personal data, Meridukan will take appropriate measures as required by law. Meridukan does not knowingly seek unnecessary personal data from children.

________________________________________

21. VENDOR RESPONSIBILITIES

Vendors using Meridukan are responsible for ensuring that:

• Product information submitted by them is accurate; • They use customer information only for authorised marketplace purposes; • They do not misuse customer information; • They do not independently use customer information for unauthorised marketing; • They maintain appropriate security measures; • They comply with applicable privacy, consumer protection and other laws. Vendors must not sell, rent, disclose or misuse customer personal information obtained through Meridukan except where legally permitted or necessary for authorised order fulfilment.

________________________________________

22. DELIVERY PARTNER RESPONSIBILITIES

Delivery partners may receive limited customer information necessary for delivery. Delivery partners must use such information only for authorised delivery-related purposes and must not: • Sell customer information; • Use customer information for unauthorised marketing; • Retain unnecessary customer information; • Disclose customer information to unauthorised persons.

________________________________________

23. FRAUD PREVENTION AND PLATFORM SECURITY

Meridukan may analyse account, device, transaction, order, referral and delivery information to detect: • Fake accounts; • Multiple fraudulent accounts; • Payment fraud; • COD abuse; • Referral abuse; • Suspicious transactions; • Unauthorised account activity; • Other attempts to misuse the Platform. Where legally permitted, Meridukan may restrict, suspend or investigate accounts associated with suspected fraudulent activity.

________________________________________

24. REFUND, RETURN AND DISPUTE INFORMATION

Information related to returns, cancellations, refunds and disputes may be processed to: • Verify the relevant transaction; • Communicate with vendors; • Coordinate logistics; • Process refunds; • Resolve customer complaints; • Prevent fraudulent claims; • Maintain necessary records.

________________________________________

25. LEGAL AND REGULATORY COMPLIANCE

Meridukan operates as an e-commerce marketplace and may be subject to applicable Indian laws and regulations.

These may include, as applicable:

• Digital Personal Data Protection Act, 2023; • Digital Personal Data Protection Rules, 2025; • Consumer Protection Act, 2019; • Consumer Protection (E-Commerce) Rules, 2020; • Information Technology Act, 2000 and applicable rules; • Applicable tax and accounting laws; • Applicable payment and financial regulations; • Other laws and regulations applicable to the Platform’s activities. The Consumer Protection (E-Commerce) Rules, 2020 expressly cover e-commerce models including marketplace and inventory models.

________________________________________

26. DATA PROCESSORS AND SERVICE PROVIDERS

Meridukan may engage third-party Data Processors/service providers to process information on its behalf.

Such service providers may include providers of:

• Hosting; • Cloud storage; • Payment processing; • SMS and OTP; • Email; • Customer support; • Analytics; • Security; • Logistics; • Software infrastructure. Meridukan may require appropriate contractual and security safeguards from relevant service providers, subject to applicable law.

________________________________________

27. CROSS-BORDER DATA PROCESSING

Where personal data is processed or stored outside India through third-party service providers, such processing may be subject to applicable Indian law and any applicable restrictions or requirements concerning transfer of personal data. Meridukan may take appropriate contractual, technical or organisational measures as required under applicable law.

________________________________________

28. CHANGES TO THIS PRIVACY POLICY

Meridukan may update this Privacy Policy from time to time to reflect: • Changes in our services; • New features; • Changes in technology; • Changes in legal requirements; • Changes in data-processing practices. The updated Privacy Policy will be published on Meridukan.app with the revised “Last Updated” date. Where legally required, Meridukan may provide additional notice or obtain consent for material changes.

________________________________________

29. GRIEVANCE REDRESSAL

If you have a privacy-related concern, complaint or request, you may contact our designated privacy/grievance contact. Grievance Officer / Privacy Contact: [Name] Designation: [Designation] Email: [Privacy Email] Phone: [Phone Number] Address: [Registered Office Address] Please include sufficient information regarding your concern so that we can investigate and respond appropriately.

________________________________________

30. HOW TO CONTACT US

For privacy, data access, correction, deletion, consent withdrawal or other data-related requests: Meridukan.app Legal Entity: [Legal Company Name] Email: [Privacy Email] Customer Support: [Support Email] Phone: [Support Number] Registered Address: [Full Address] Website: Meridukan.app

________________________________________

31. GOVERNING LAW

This Privacy Policy shall be interpreted in accordance with the applicable laws of India. Any legal proceedings relating to the Platform or this Privacy Policy shall be subject to the jurisdiction of the courts having jurisdiction under applicable Indian law.

________________________________________

32. USER ACKNOWLEDGEMENT

By using Meridukan.app, you acknowledge that:

1. You have read this Privacy Policy; 2. You understand how your personal data may be processed; 3. You understand that certain information may be shared with vendors, delivery partners, payment providers and service providers where necessary for providing the requested services; 4. You understand that OTP may be used for delivery verification; 5. You understand that payment transactions may be processed by third-party payment providers; 6. You understand that referral/earning eligibility is subject to the applicable programme conditions; 7. You agree to use the Platform in accordance with applicable laws and Meridukan’s Terms and Conditions. Meridukan.app reserves the right to update this Privacy Policy from time to time in accordance with applicable law. Last Updated: [DD/MM/YYYY]